Bryan Cantrill on Jails and Solaris Zones on HackerTube: recommended by 6 Hacker News commenters across 6 separate months, 2016–2025.
talk · intermediate · evergreen
Bryan Cantrill's Papers We Love talk on FreeBSD Jails and Solaris Zones, tracing how OS-level virtualization grew out of chroot and the limits of the traditional UNIX security model.
Recommended repeatedly as the best account of container history and how Zones built on and went beyond Jails.
“I highly recommend this talk, talking about Jails and Zones.”
9 Hacker News comments link this video. Each one links back to its thread.
I highly recommend this talk, talking about Jails and Zones. Jails was first, but Zones took a lot of lessens from it and went further. ▶ this video
in “"Doors" in Solaris: Lightweight RPC Using File Descriptors (1996)” · View on HN
Bryan Cantrill has a wonderful talk about exactly this in Illumos that I recommend at every opportunity ▶ this video
in “Running I3 Window Manager on Ubuntu for Windows” · View on HN
FreeBSD jails were released in 2000 in FreeBSD 4.0. Solaris Zones in 2004/2005. In fact, the original Solaris Zones paper cites jails as inspiration. Jails: Confining the omnipotent root (2000): < [link] > Solaris Zones: Operating System Support for Consolidating Commercial Workloads (2004): < [link] > Originally, jails didn't virtualise the network stack. That was added later, in FreeBSD 8.0 with VNETs, which were buggy for a long time, but went through extensive testing and are enabled by default since FreeBSD 12.0 (quite recently). Solaris Zones went a step further than the original design, and run a separate network stack for each zone from the start, years before FreeBSD did. BTW, recommended talk about those topics: Papers We Love: Jails and Zones: < ▶ this video >
in “Sun: The Network Is the Computer” · View on HN
This talk by Bryan Cantrill on the history of OS-level virtualization is great. ▶ this video Apparently the first version of Jails was a few hundred lines of code.
in “Gocker: Docker implemented in 1.3k lines of Go” · View on HN
Bryan Cantrill has a nice talk which starts with a bit of history on containers (chroot, FreeBSD jails, Solaris zones, etc.). ▶ this video
in “Comprehensive and biased comparison of OpenBSD and FreeBSD [pdf]” · View on HN
I am watching it now but he's talking about VMs ("KVM") and not "containers". As to why we're in this mess, this rather amusing talk by B. Cantrill discusses the history: ▶ this video (Linux) Containers are not VMs: [link]
in “Memory Deduplication: The Curse that Keeps on Giving [video]” · View on HN
1st of all yes, many people consider not only chroot to be virtualization (of the file system). Yes it is arguable as it is the birth of lightweight virtualization. But you were wrong in saying no one does. [link] ▶ this video 2nd containers go farther and virtualize network, and other resources.
in “Kubernetes Home – what do you do if your ISP changes your IP addresses?” · View on HN
I love Haiku -- and their inspiration in BeOS brings back my memories of deciding not to work for Be in 1996, and then later hitting jackpot at the Be Inc. bankruptcy auction.[1] [1] ▶ this video
in “Haiku Project” · View on HN
.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD. Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even earlier. GNU/Linux is still playing catch-up, and as long as people like myself, Bryan Cantrill, Adam Leventhal and the rest of the former Sun kernel engineers live, it will be playing catch-up forever. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. In order for that opinion of yours to actually mean anything, the question is: how many packaging formats do you know to produce packages for? Only then will you be in a position where you would actually be competent to make such a statement, and where your opinion would actually make a diffe
in “Docker Storage: An Introduction” · View on HN